CVE-2026-45146 Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...

CVE-2026-45146 Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...

CVE-2026-45146

An authenticated administrator can exploit a SQL injection vulnerability in Chamilo LMS prior to versions 1.11.40 and 2.0.1 . The issue exists in the get_sessions action within /main/inc/ajax/model.ajax.php when _search=true is used. Because the groupOp field in the JSON filters parameter is not ...

CVE-2026-95748 Unauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric Composer

A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...

EUVD-2026-116166

A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...

CVE-2026-95748

A SQL injection vulnerability exists in HPE Networking Fabric Composer . This flaw allows an unauthenticated adjacent attacker to execute arbitrary database commands . The provided documents do not specify the exact component, file, or version affected, nor do they provide specific remediation st...

CVE-2026-44265

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax...

CVE-2026-44265

The Elo expression language for no-code tools (versions prior to 1.0.1 ) contains a vulnerability in its programmatic AST API . The system fails to perform runtime syntax validation when interpolating arbitrary values from JSON-deserialized input , plugin outputs, or other untyped sources into ge...

SUSE CVE-2026-120062

SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with th...

SUSE CVE-2026-120065

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-109594

Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...

Amelia (WordPress plugin): SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10...

EUVD-2026-116040

Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...

CVE-2026-109594

A post-authentication SQL Injection vulnerability (CWE-89) exists in the End-of-Life SonicWall GMS version 9.5.2 and earlier. Under specific conditions, an authenticated attacker can access or modify information stored within the GMS database. No specific exploitation details or remediation steps...

CVE-2026-109594

Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...

CVE-2026-65139

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...

CVE-2026-65139

NVIDIA Slurm is vulnerable to an attacker-controlled SQL injection attack within certain SlurmDBD RPCs . This vulnerability could potentially lead to arbitrary code execution . The issue was addressed in the Debian stable distribution (trixie) with version 24.11.5-4+deb13u1 . Exploitation details...

EUVD-2026-116013

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...

CVE-2026-65139

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...

CVE-2026-110265 runZero search SQL injection

A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1...